Tauri 2.0 Granular IPC Command Capability Scoping & Shell Sandboxing

--- description: Tauri 2.0 Granular IPC Command Capability Scoping & Shell Sandboxing - Enforces granular, least-privilege capability manifests in Tauri 2.0 to eliminate Remote Code Execution (RCE) vectors from compromised webview contexts. Mandates strict argument validation regexes, explicit window bindings, and forbids ambient or wildcard shell permissions. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-ipc-granular-capability-scoping" --- # Tauri 2.0 Granular IPC Command Capability Scoping & Shell Sandboxing > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Wildcard shell permissions and unbounded command execution via Tauri IPC. ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Granular IPC Command Capability Scoping. Mandate invariants that prevent webview XSS-to-RCE pivots. Enforce explicit capability files under `src-tauri/capabilities/` with exact program paths, regex-bounded argument scopes, and isolated window targets. Forbid wildcard permissions (e.g., `shell:default`, `core:default`) and untyped raw string execution. ## Strict Guidelines - Engineers MUST ALWAYS isolate native shell capabilities into specific manifest files under `src-tauri/capabilities/` targeted exclusively to designated window labels. - Engineers MUST NOT grant broad plugin permissions such as `shell:default` or `shell:allow-execute` without strict argument array and regex constraints. - Code MUST explicitly specify each allowed command, binary name, and regex-validated argument list in capability JSON manifests. - Services MUST sanitize and strictly validate all dynamic arguments inside Rust-side custom IPC commands rather than passing arbitrary user input directly to `tauri_plugin_shell`. - Components NEVER invoke shell commands directly from the frontend using raw strings or unsanitized external URIs via `open` or `execute` APIs. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants ambient wildcard shell execution to all windows without command scoping or argument validation. Any Cross-Site Scripting (XSS) vulnerability immediately escalates to arbitrary Remote Code Execution (RCE). ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-capability", "description": "Insecure default shell access across all windows", "windows": ["*"], "permissions": [ "core:default", "shell:default", "shell:allow-execute" ] } ``` #### Production Standard (Correct) > **Standard**: Scopes execution strictly to the 'main' window, restricts the binary to 'git', fixes permissible arguments, and bounds dynamic parameters with deterministic regular expressions. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-capability", "description": "Least-privilege scoped git status command for main window", "windows": ["main"], "permissions": [ "core:default", { "identifier": "shell:allow-execute", "allow": [ { "name": "run-git-status", "cmd": "git", "args": ["status", "--porcelain"] }, { "name": "run-git-log", "cmd": "git", "args": [ "log", { "validator": "^-[nN] [0-9]{1,2}$" } ] } ] } ] } ``` ### Rust Custom IPC Command with Backend Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Spawns an interactive shell process ('sh -c') taking unvalidated string input from the webview, leading directly to shell injection and arbitrary code execution. ```rust // Insecure: passes untrusted string directly to system command execution #[tauri::command] pub async fn run_diagnostic(subcommand: String) -> Result<String, String> { let output = std::process::Command::new("sh") .arg("-c") .arg(format!("diagnostics {}", subcommand)) .output() .map_err(|e| e.to_string())?; Ok(String::from_utf8_lossy(&output.stdout).to_string()) } ``` #### Production Standard (Correct) > **Standard**: Uses strongly typed Rust enums to eliminate string concatenation, invokes absolute binary paths directly without intermediate shells, and enforces deterministic command arguments. ```rust // Secure: typed enum input with strict allowlist and argument decoupling #[derive(serde::Deserialize)] #[serde(rename_all = "kebab-case")] pub enum DiagnosticTarget { Network, Memory, Disk, } #[tauri::command] pub async fn run_diagnostic(target: DiagnosticTarget) -> Result<String, String> { let arg = match target { DiagnosticTarget::Network => "--net", DiagnosticTarget::Memory => "--mem", DiagnosticTarget::Disk => "--disk", }; let output = std::process::Command::new("/usr/local/bin/diagnostics-tool") .arg(arg) .output() .map_err(|e| format!("Execution failed: {e}"))?; Ok(String::from_utf8_lossy(&output.stdout).to_string()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Granular IPC Command Capability Scoping & Shell Sandboxing

Tauri 2.0 Granular IPC Command Capability Scoping & Shell Sandboxing defines an industrial-grade behavioral standard for security engineering. Enforces granular, least-privilege capability manifests in Tauri 2.0 to eliminate Remote Code Execution (RCE) vectors from compromised webview contexts. Mandates strict argument validation regexes, explicit window bindings, and forbids ambient or wildcard shell permissions. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard shell permissions and unbounded command execution via Tauri IPC. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard shell permissions and unbounded command execution via Tauri IPC.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate native shell capabilities into specific manifest files under `src-tauri/capabilities/` targeted exclusively to designated window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.